XChat explained: what it is and how to turn it on

#Quick answer

XChat is X's encrypted messaging product. It shows up as a Chat tab inside X (formerly Twitter) and as a standalone XChat app you sign into with your existing X account, and everything inside it is end-to-end encrypted rather than sitting in plain text like old direct messages. Turning it on takes one screen: open Chat, let X generate a key pair for your account, and set a PIN.

What matters before you move private conversations there is further down: what the encryption actually covers, what it leaves exposed, and what independent researchers found when they pulled the app apart.

Last verified: 21 September 2026, against X's own help center and developer documentation.

#What XChat actually is

Two things share the name, which is most of the confusion.

One is a feature inside X. Chat is a tab in the toolbar of the X app and on x.com. Register once and your encrypted conversations live there, alongside the ordinary inbox.

The other is a standalone app called XChat. It launched on iPhone and iPad on 24 April 2026 (TechCrunch) and reached Android on 29 June 2026 (iTechPost). It is a messenger with no timeline attached. You sign in with the X account you already have, so your contacts are the people you already follow, and nobody has to swap phone numbers.

Both talk to the same system. X's help center is explicit that to exchange encrypted messages, both people need to have registered for Chat, either in the X apps, on the web, or through the XChat app (X Help Center).

#How to turn on XChat

1. Open the Chat tab in the X toolbar, or install the XChat app and sign in with your X account.
2. X creates a public and private key pair tied to your account the first time you enter Chat.
3. Set a PIN. X says the PIN never leaves your device; it is used to protect the private key that X stores for you.
4. Start a conversation. The other person has to have registered for Chat too, or there is nothing to encrypt to.

Most people get the PIN wrong. It is not a second password for your account. It is the key to your key, and it is how you get your encrypted history back on a new phone. X's help center describes a hardware-backed store with a guess counter that stops at 20 wrong attempts, after which the stored shares become permanently inaccessible. That is a deliberate design choice - it stops anyone brute-forcing a four-digit code - and it also means a forgotten PIN is unrecoverable.

#What XChat does that ordinary DMs never did

Screenshot blocking is the feature people test first and misunderstand fastest. It stops the operating system's screenshot on a supported device and tells the other person an attempt happened. It does not stop a second phone pointed at the screen. Treat it as friction and a signal, not a lock.

Disappearing messages are per-conversation and set by you. If you are used to the way a deleted DM on X still sits in the other person's inbox, this is the fix for that specific annoyance, because the message is removed on both sides at the time you set.

#What the encryption protects, and what it does not

X's developer documentation is unusually blunt about the model: message bodies are encrypted on the client, and "X routes ciphertext and cannot read plaintext content" (X developer docs). A per-conversation key encrypts the content; your key pair is what moves that conversation key between participants safely.

Now the limits, in plain terms.

Metadata is not encrypted. X's help center states that associated metadata, such as recipient and creation time, is not protected, and that if posts are shared inside an encrypted chat, X has a record that those posts were shared. Who you talk to and when is still visible to the platform. Only what you said is not.

Your private key lives on X's infrastructure. X stores it split into shares using the open-source Juicebox protocol, recoverable only with your PIN. Researchers at Mysk reported in April 2026 that every one of those storage realms is hosted under the x.com domain and controlled by X, and that the app did not implement certificate pinning (CyberInsider). Splitting a secret across servers you also control is not the same guarantee as splitting it across independent custodians.

There is no forward secrecy. Matthew Garrett's June 2025 teardown found that a compromised private key would expose previously sent messages as well, a property audited messengers have had for over a decade (CyberInsider).

Verification exists, but you have to use it. X now documents safety numbers, derived from both people's public keys, which you compare out of band to confirm you are talking to who you think you are. That directly answers one of the earlier criticisms. It only helps if you actually compare them.

No published independent audit of the current implementation exists as of September 2026. The honest summary: XChat is a real improvement over unencrypted direct messages, and it is not the right tool for a conversation where being wrong has serious consequences.

#The X Number, and who can reach you

X added a code called an X Number. It is an optional private code you create and share so that someone can message or call you in Chat even if they do not follow you and your inbox is closed to strangers. X's help center is clear that it is not a phone number and not the same as a safety number, and that having one does not change what other people see when they try to message you.

Refreshing it is the useful part. Hand the code to a client, a podcast guest or a recruiter, and if it ends up somewhere you did not intend, generating a new one revokes access for everyone holding the old one. That is the piece a phone number never gave you.

The old controls still apply underneath. Your "allow message requests" setting, the Premium gate on cold messages, and blocking an account all behave the way they did before. If you are unsure how the basic inbox rules work, start with how to send a DM on X, then come back to Chat.

#What this changes if you use X for work

For anyone building an audience, three practical consequences.

Inbound gets better and harder to mine. Encrypted, callable, screenshot-flagged conversations are a nicer place to take a real conversation with a customer. They are also a worse place to run volume outreach, which is the point.

Your read receipts and notification habits carry over. The same settings discipline applies; if you are the kind of person who turns read receipts off, do it in Chat before you start using it, not after.

Nothing about Chat grows an audience. DMs convert attention you already earned. The posting still has to happen in public, and that is the part worth automating. X-Autopilot drafts and posts in your own voice from real Chrome on your own Mac, so your session cookie stays on your machine rather than in a shared cloud service. That is a lower detection surface than cloud tools, not a guarantee of anything: browser automation is not sanctioned by X's automation rules, and reading those directly beats trusting any vendor's summary of them, including ours.

#Bottom line

XChat is X's serious attempt at a messenger: encrypted content, calls, disappearing messages, screenshot alerts, and a code you can hand out instead of a phone number. Setup is one PIN and takes a minute. Just keep the mental model accurate. The platform still sees who you messaged and when, your private key sits on X's servers behind that PIN, there is no forward secrecy, and no outside auditor has signed off on the implementation. Good enough for most conversations. Not the thing to bet something important on.